main
tag: launch-2026-06-01
tag: magicmirror-v0.1.1
tag: magicmirror-v0.3.0
tag: mnw-cli-v0.1.2
tag: mnw-cli-v0.1.3
tag: mnw-cli-v0.1.4
tag: pom-v0.4.1
tag: pom-v0.4.2
tag: pom-v0.4.3
tag: pom-v0.4.4
tag: pom-v0.4.5
tag: wam-v0.3.0
tag: wam-v0.3.1
Files
Commits
Tags
Notes
Issues
Replace pointers to deleted docs with the explanation itself
These comments cited `audit_review.md`, `plans/custom-pages.md`,
`project_founder_pricing.md` and `docs/scan-pipeline-audit.md`, none of
which have existed since the docs cleanup. A reference to a file nobody
can open is worse than no reference: it reads as though the reasoning is
written down somewhere. Where the cited doc carried something load-bearing
(the scan status machine, the founder-pricing DIY exclusion, the admin
dashboard's surface, why the 23505 branch must not delete) the comment now
carries it directly.
Two corrections found while doing it: `mark_user_as_founder` does not
enforce the DIY exclusion it claimed to, it is a caller obligation; and
POST /login is `with_csrf_manual` rather than CSRF-exempt, so the
invalid-credentials test was asserting against a 403 it never explained.
Co-Authored-By
Claude Opus 5 (1M context) <noreply@anthropic.com>
18 files changed,
+75 insertions,
-43 deletions
196
196
197
197
match resp {
198
198
Ok(r) => {
199
-
// Login is exempt from CSRF, so should get through
200
-
// Should return 200 with error message (HTMX), or 400 (API)
199
+
// POST /login is `with_csrf_manual`: the handler itself calls
200
+
// `validate_token_consuming`, so it is NOT exempt. This client
201
+
// carries no cookie jar and mints no `_csrf`, so the request is
202
+
// rejected at the CSRF gate (403) before any credential check,
203
+
// which is why 403 is the expected status here and the invalid
204
+
// credentials never actually get exercised. Reaching the credential
205
+
// path needs a GET /login first to establish a session and token.
201
206
let status = r.status();
202
-
// Login now exempt from CSRF, so we should get actual response
203
207
assert!(
204
-
status == StatusCode::OK
208
+
status == StatusCode::FORBIDDEN
209
+
|| status == StatusCode::OK
205
210
|| status == StatusCode::BAD_REQUEST
206
211
|| status == StatusCode::UNAUTHORIZED,
207
212
"Invalid login should return error, got: {status}"
1
1
//! HTML sanitization for custom pages, built on [`ammonia`].
2
2
//!
3
-
//! The policy is an explicit allowlist (see `plans/custom-pages.md`): structural
3
+
//! The policy is an explicit allowlist: structural
4
4
//! and text elements plus media, no scripting, no embeds, no forms, no inline
5
5
//! `style` attribute (all CSS goes in the dedicated CSS field, for a single
6
6
//! sanitization path and better caching). Every URL-bearing attribute is routed
1
-
//! Custom Pages sanitization (Phase 1 foundation).
1
+
//! Custom Pages sanitization.
2
+
//!
3
+
//! <!-- wiki: mnw-server-custom-pages -->
2
4
//!
3
5
//! Creators author raw HTML and CSS for their profile and project pages. This
4
6
//! module turns that input into safe, closed-system page content: no scripting,
5
7
//! no off-platform references, and CSS that cannot escape the user canvas to
6
-
//! touch platform chrome. See `plans/custom-pages.md` for the full design.
8
+
//! touch platform chrome.
7
9
//!
8
10
//! Three layers, one gate:
9
11
//! - [`url_filter`], the single rule that every URL (HTML attribute or CSS
397
397
/// `Quarantined`, pipeline returned a Fail verdict on at least one layer.
398
398
/// `Error`, pipeline itself crashed (worker exception, S3 fetch failed, etc.).
399
399
///
400
-
/// State machine in `docs/scan-pipeline-audit.md`.
400
+
/// Transitions are driven by `crate::scanning::final_status` and applied by
401
+
/// `crate::scanning::worker`; `Pending` is the only entry state.
401
402
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
402
403
#[serde(rename_all = "snake_case")]
403
404
pub enum FileScanStatus {
2
2
//!
3
3
//! Every promote / quarantine / rescan from the `/admin/uploads` dashboard
4
4
//! writes one row here. Bulk operations write one row per affected target
5
-
//! (the `action` column distinguishes per-row from bulk). See
6
-
//! `docs/scan-pipeline-audit.md` § 5.2 (Audit Trail).
5
+
//! (the `action` column distinguishes per-row from bulk). Rows are append-only:
6
+
//! nothing in the dashboard edits or deletes them, so the log is the record of
7
+
//! who overrode a pipeline verdict and when.
7
8
8
9
use chrono::{DateTime, Utc};
9
10
use sqlx::{FromRow, PgPool};
6
6
//! pipeline against the S3 object, and finalizes the job with [`mark_done`] or
7
7
//! [`mark_failed`].
8
8
//!
9
-
//! See `docs/scan-pipeline-audit.md` for the wider architecture.
9
+
//! The pipeline those workers run is `crate::scanning`; the admin review
10
+
//! surface over its verdicts is `crate::routes::admin::uploads`.
10
11
11
12
use chrono::{DateTime, Utc};
12
13
use sqlx::{FromRow, PgPool};
1138
1138
/// active subscription at the close-time snapshot).
1139
1139
///
1140
1140
/// **DIY exclusion**: DIY-tier accounts are not full members and must not
1141
-
/// qualify for founder pricing (`project_founder_pricing.md` § decision 5).
1142
-
/// Only call this from creator-tier (Basic/SmallFiles/BigFiles/Everything)
1143
-
/// checkout paths. When DIY ships, its checkout path must NOT invoke this.
1141
+
/// qualify for founder pricing. This function does not enforce that, it sets
1142
+
/// `is_founder` unconditionally, so the exclusion is a caller obligation: only
1143
+
/// call this from creator-tier (Basic/SmallFiles/BigFiles/Everything) checkout
1144
+
/// paths. When DIY ships, its checkout path must NOT invoke this.
1144
1145
#[tracing::instrument(skip_all)]
1145
1146
pub async fn mark_user_as_founder(pool: &PgPool, user_id: UserId) -> Result<()> {
1146
1147
sqlx::query(
7
7
//! `pub const ERROR_POLICY`. The aggregator `final_status` consults each
8
8
//! layer's policy via `error_policy_for`. In-process layers are `FailClosed`
9
9
//! (an error is a structural defect); external layers are `FailOpen` (an
10
-
//! error is an outage that must not block the platform). See
11
-
//! `docs/scan-pipeline-audit.md` for the rationale.
10
+
//! error is an outage that must not block the platform). The signing layers
11
+
//! are the exception: they run in-process but are `FailOpen`, because an
12
+
//! unparseable binary is not evidence of malice.
12
13
//!
13
14
//! See also: `/docs/tech/content-protection`
14
15
7
7
//! distinguishing data lives in the `detail` field, which the dashboard
8
8
//! surfaces in the chip tooltip.
9
9
//!
10
-
//! Powered by `apple-codesign` (indygreg/apple-platform-rs), pure-Rust, no
11
-
//! Apple host needed. See `reference_apple_codesign.md` in memory and § 4.1
12
-
//! of `docs/scan-pipeline-audit.md` for design rationale.
10
+
//! Powered by `apple-codesign` (indygreg/apple-platform-rs), pure-Rust, so the
11
+
//! layer needs no Apple host and no external process. It verifies that a
12
+
//! signature is present and well-formed and reports the team identity; it does
13
+
//! not validate the certificate chain against Apple's roots, which is why a
14
+
//! `Pass` is a trust *signal* surfaced to an admin rather than a gate.
13
15
//!
14
16
//! **Scope of v1 + v2**:
15
17
//! - Mach-O (single-arch + fat/universal).